You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/ci-cd-custom-content.md
-34Lines changed: 0 additions & 34 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -75,7 +75,6 @@ We've provided a sample repository with templates for each of the content types
75
75
76
76
Although you can build templates from scratch, it's often easier to start from either the Sentinel Public GitHub repository YAML files or from out-of-the-box Microsoft Sentinel content. This table outlines how to convert an ARM template for use with Microsoft Sentinel Repositories.
77
77
78
-
79
78
| Content Type | Convert from Sentinel Public YAML | Export from Sentinel | Template Reference | Sample Templates |
|**Analytic rules**|[PowerShell script](https://github.com/Azure/Azure-Sentinel/blob/master/Tools/ConvertYamlToJson/ConvertSentinelRuleFrom-Yaml.ps1)|[Export feature](/azure/sentinel/import-export-analytics-rules#export-rules) or [PowerShell script](https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Az.SecurityInsights-Samples/Alert%20Rules/Export%20Analytics%20Rules)|[Reference](/azure/templates/microsoft.securityinsights/2025-03-01/alertrules)|[ARM Templates](https://github.com/Azure/Azure-Sentinel/tree/master/Tools/ARM-Templates/AnalyticsRules)|
@@ -134,39 +133,6 @@ Once the workflow or pipeline is triggered, the deployment supports the followin
134
133
135
134
These options are available through a feature of the PowerShell deployment script called from the workflow or pipeline. For more information on how to implement these customizations, see [Customize repository deployments](ci-cd-custom-deploy.md#customize-your-connection-configuration).
136
135
137
-
138
-
## Common repository architecture patterns for MSSPs
139
-
140
-
A key consideration with multi-customer CI/CD pipelines is choosing the best structure to serve all clients. While there’s no universal approach, here are three patterns we recommend considering:
141
-
142
-
**Pattern 1: Central repository for generic content, customer-specific repositories for tailored content**
143
-
- One central repository for common content deployed to all customers
144
-
- Individual repositories for customer-specific customizations
145
-
- Each customer workspace connects to both repositories
146
-
- Optimal for MSSPs with balanced common and tailored content needs
147
-
148
-
:::image type="content" source="media/playbook-mssps/sentinel-content-deployment-diagram.png" alt-text="Repository architecture showing central and customer-specific content deployment":::
149
-
150
-
**Pattern 2: Single repository with custom folders**
151
-
- All content in one repository
152
-
- Folder structure based on shared data sources - for example, Entra ID Analytics - or customer names
153
-
- Deployment pipelines customized per customer connection
154
-
- Requires more initial setup but simplifies repository management
- Full customization flexibility for each customer
161
-
- Best for customers with unique content requirements
162
-
- Higher management overhead but maximum isolation
163
-
164
-
:::image type="content" source="media/playbook-mssps/ci-cd-pipeline-diagram.png" alt-text="Individual repository architecture per customer tenant":::
165
-
166
-
To customize your CI/CD pipelines, use configuration files in each repository branch to prioritize deployment of high-priority content, exclude content you don’t want to deploy, and map parameter files to their corresponding content files. For more information, see [Customize your connection configuration](/azure/sentinel/ci-cd-custom-deploy#customize-your-connection-configuration).
167
-
168
-
For more information about how to use Azure DevOps in multitenant scenarios, see [Use Azure DevOps to manage Sentinel for MSSPs and Multi-tenant Environments](https://techcommunity.microsoft.com/blog/microsoftsentinelblog/use-azure-devops-to-manage-sentinel-for-mssps-and-multi-tenant-environments/4008109).
169
-
170
136
## Next steps
171
137
172
138
Get more examples and step by step instructions on deploying Microsoft Sentinel repositories.
0 commit comments